Information Disclosure

Every one of the 46 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Look…CVE-2019-15623Nextcloud · 1.9% likely

   CWE-3591 bounty report

2. Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in…CVE-2016-9459Nextcloud · 1.5% likely

   CWE-2091 bounty report

3. Missing rate limit when trying to join a password protected Nextcloud Talk conversationCVE-2022-35932nextcloud · CVSS 3.5 · 1.4% likely

   CWE-3591 bounty report

4. File path disclosure of shared files in Nextcloud Text applicationCVE-2021-32734nextcloud · CVSS 3.1 · 1.4% likely

   CWE-2091 bounty report

5. Lack of ratelimit on Richdocuments OCS endpoint in nextcloudCVE-2021-37629nextcloud · CVSS 5.3 · 1.4% likely

   CWE-200

6. Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on the lookup server ins…CVE-2021-22905Nextcloud · 1.4% likely

   CWE-2001 bounty report

7. Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only the local Ne…CVE-2021-22913Nextcloud · 1.4% likely

   CWE-2001 bounty report

8. Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only on the local Nextclo…CVE-2021-22912Nextcloud · 1.4% likely

   CWE-2001 bounty report

9. Nextcloud Text app can disclose existence of folders in "File Drop" link shareCVE-2021-32766nextcloud · CVSS 5.3 · 1.3% likely

   CWE-209

10. User enumeration setting not respected in Nextcloud serverCVE-2021-41239nextcloud · CVSS 5.3 · 1.2% likely

    CWE-200

11. Default settings leak federated cloud ID to lookup server of all usersCVE-2021-32653nextcloud · CVSS 2.7 · 1.2% likely

    CWE-2011 bounty report

12. Bypass of image blocking in Nextcloud MailCVE-2021-32707nextcloud · CVSS 4.3 · 1.1% likely

    CWE-2001 bounty report

13. Error in deleting deck cards attachment reveals the full application path in Nextcloud DeckCVE-2022-24906nextcloud · CVSS 3.5 · 1.1% likely

    CWE-2001 bounty report

14. A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares.CVE-2018-16467Nextcloud · 1.1% likely

    CWE-2001 bounty report

15. File path disclosure of shared files in Richdocuments applicationCVE-2021-39223nextcloud · CVSS 4.8 · 1.1% likely

    CWE-200

16. Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud TalkCVE-2022-24890nextcloud · CVSS 2.4 · 0.9% likely

    CWE-3591 bounty report

17. Bypass of image blocking in Nextcloud MailCVE-2021-39220nextcloud · CVSS 3.5 · 0.9% likely

    CWE-200

18. Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of file in write-only share. Due to an error in the application logic an adversary with…CVE-2017-0885Nextcloud · 0.9% likely

    CWE-2091 bounty report

19. Malicious Android app could access Shared Preferences of the Nextcloud Android clientCVE-2021-32695nextcloud · CVSS 3.9 · 0.9% likely

    CWE-2001 bounty report

20. File path disclosure of shared files in OfficeOnline applicationCVE-2021-39224nextcloud · CVSS 3.5 · 0.9% likely

    CWE-200

21. Nextcloud Talk guests can continue to receive video streams from call after being removed from a conversationCVE-2022-41971nextcloud · CVSS 4.8 · 0.9% likely

    CWE-3591 bounty report

22. Password disclosure in log file in Nextcloud Mail AppCVE-2022-31119nextcloud · CVSS 3.1 · 0.8% likely

    CWE-5321 bounty report

23. Full path of data directory exposed to Nextcloud server usersCVE-2023-28834nextcloud · CVSS 3.5 · 0.8% likely

    CWE-2121 bounty report

24. Nextcloud Talk messages can still be seen on conversation after expiring when cron is misconfiguredCVE-2023-26041nextcloud · CVSS 2.6 · 0.8% likely

    CWE-3591 bounty report

25. Authentication headers exposed on by Nextcloud ServerCVE-2022-36074nextcloud · CVSS 6.4 · 0.8% likely

    CWE-2001 bounty report

26. Nextcloud Mail auto configurator can be tricked into sending account information to wrong serversCVE-2024-52508nextcloud · CVSS 8.2 · 0.8% likely

    CWE-2001 bounty report

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.